Vehicle control system and vehicle control method

ABSTRACT

A vehicle control system includes a plurality of devices, a first device included in the devices including: a storage configured to store consistency information including a permitted combination of versions of software installed on each of one or more devices in association with each of the control functions; a determination unit configured to determine whether the consistency information consistent with versions of software installed on a part of the devices exists when consistency does not exist in the versions of all software installed on each of the devices; and a performance control unit configured to permit performance of a part of control functions associated with the consistency information consistent with the versions of software installed on the part of the devices when the consistency information consistent with the versions of software installed on the part of the devices exists.

INCORPORATION BY REFERENCE

This application is a continuation of U.S. application Ser. No.16/277,182 filed on Feb. 15, 2019, which claims the benefit of priorityof Japanese Patent Application No. 2018-040982 filed on Mar. 7, 2018.The disclosures of these prior applications are incorporated herein byreference in their entirety.

BACKGROUND 1. Technical Field

The present disclosure relates to a vehicle control system and a vehiclecontrol method.

2. Description of Related Art

Various automated driving systems have been being developed in recentyears. Such an automated driving system is configured by combining aplurality of in-vehicle devices performing vehicle control such asacceleration, deceleration and steering. In a system composed of aplurality of in-vehicle devices, such as an automated driving system,there is a possibility that unexpected vehicle control is performed whena combination of versions of software of the in-vehicle devices is notconsistent with a combination of versions of software which combinationis beforehand confirmed to operate. Accordingly, for such a systemcomposed of a plurality of in-vehicle devices, it is important toexamine consistency in versions of software of the plurality ofin-vehicle devices.

For example, Japanese Patent Application Publication No. 2009-53920discloses a system composed of a plurality of ECUs. In the system, inorder to prevent occurrence of operation failure due to inconsistency inversions of programs of the ECUs, referring to dependency relationinformation between a version-upgrading program for an ECU the programof which is to be updated and the programs of the other ECUs beforeupdate of the program, it is determined whether or not the program canbe updated.

SUMMARY

In the aforementioned vehicle control system composed of the pluralityof in-vehicle devices, in the case where versions of software of one orsome of in-vehicle devices are not consistent with the version which isconfirmed to operate, when all the control functions composing thevehicle control by the vehicle control system are prohibited, there is apossibility that convenience of a user deteriorates.

The present disclosure provides a vehicle control system and a vehiclecontrol method capable of improving convenience of a user even in asituation where use of one or some of in-vehicle devices is restricted.

A vehicle control system according to a first aspect of the presentdisclosure is configured to perform predetermined vehicle control with acombination of a plurality of control functions. The system includes aplurality of devices mounted on a vehicle and including a first device,the control functions being attained by performing each softwareinstalled on the devices, wherein the first device includes: a firststorage configured to store first consistency information including apermitted combination of versions of all software installed on each ofthe devices; a second storage configured to store second consistencyinformation including one or more devices and a permitted combination ofversions of software installed on each of the one or more devices inassociation with each of the control functions; a version acquisitionunit configured to acquire versions of software installed on the otherdevices than the first device; a first determination unit configured todetermine whether consistency exists in the versions of all softwareinstalled on each of the devices by collating the version of softwareinstalled on the first device and the versions of software acquired fromthe other devices with the first consistency information; a seconddetermination unit configured to determine whether the secondconsistency information consistent with versions of software installedon a part of the devices exists by collating the version of softwareinstalled on the first device and the versions of software acquired fromthe other devices with each piece of the second consistency informationwhen the first determination unit determines that consistency does notexist in the versions of all software installed on each of the devices;and a performance control unit configured to permit performance of allof the control functions when the first determination unit determinesthat consistency exists in the versions of all software installed oneach of the devices and permit performance of a part of controlfunctions associated with the second consistency information consistentwith the versions of software installed on the part of the devices andprohibit performance of the other control functions of the vehiclecontrol system when the second determination unit determines that thesecond consistency information consistent with the versions of softwareinstalled on the part of the devices exists.

According to the first aspect, even when versions of software of one orsome of in-vehicle devices composing the vehicle control system are notconsistent with permitted versions, control functions which can beperformed by one or some of in-vehicle devices holding softwareconsistent with the permitted versions can be provided. Even when use ofone or some of in-vehicle devices is restricted and not all the controlfunctions of the vehicle control system can be provided, one or some ofcontrol functions are allowed to be provided, and thereby, convenienceof a user can be improved.

In the aforementioned aspect, the first determination unit and thesecond determination unit may be configured to perform determinationprocessing every time when a power supply of a vehicle is turned on.

According to the aforementioned configuration, since it can be examinedthat consistency exists in the versions of all software installed oneach of the in-vehicle devices composing the vehicle control systemevery time when the power supply of the vehicle is turned on, there canbe more reduced a possibility that unexpected vehicle control isperformed due to inconsistency in the versions of software of thein-vehicle devices.

In the aforementioned aspect, the permitted combination of versions ofsoftware may be a combination of versions of the software which arepermitted to be performed simultaneously.

A vehicle control method according to a second aspect of the presentdisclosure is in a vehicle control system composed of a plurality ofdevices mounted on a vehicle and configured to perform predeterminedvehicle control with a combination of a plurality of control functionsattained by performing each software installed on the devices. Themethod includes: storing, by a computer which a first device included inthe devices has, first consistency information including a permittedcombination of versions of all software installed on each of thedevices; storing, by the computer, second consistency informationincluding one or more devices and a permitted combination of versions ofsoftware installed on each of the one or more devices in associationwith each of the control functions; acquiring, by the computer, versionsof software installed on the other devices than the first device;determining, by the computer, whether consistency exists in the versionsof all software installed on each of the devices by collating theversion of software installed on the first device and the versions ofsoftware acquired from the other devices with the first consistencyinformation; determining, by the computer, whether the secondconsistency information consistent with versions of software installedon a part of the devices exists by collating the version of softwareinstalled on the first device and the versions of software acquired fromthe other devices with each piece of the second consistency informationwhen the computer determines that consistency does not exist in theversions of all software installed on each of the devices; permitting,by the computer, performance of all of the control functions when thecomputer determines that consistency exists in the versions of allsoftware installed on each of the devices; and permitting, by thecomputer, performance of a part of control functions associated with thesecond consistency information consistent with the versions of softwareinstalled on the part of the devices and prohibiting, by the computer,performance of the other control functions of the vehicle control systemwhen the computer determines that the second consistency informationconsistent with the versions of software installed on the part of thedevices exists.

According to the second aspect, even when versions of software of one orsome of in-vehicle devices composing the vehicle control system are notconsistent with permitted versions, control functions which can beperformed by one or some of in-vehicle devices holding softwareconsistent with the permitted versions can be provided. Even when use ofone or some of in-vehicle devices is restricted and not all the controlfunctions of the vehicle control system can be provided, one or some ofcontrol functions are allowed to be provided, and thereby, convenienceof a user can be improved.

According to the present disclosure, there can be provided a vehiclecontrol apparatus and a vehicle control method capable of improvingconvenience of a user even in a situation where use of one or some ofin-vehicle devices is restricted.

BRIEF DESCRIPTION OF THE DRAWINGS

Features, advantages, and technical and industrial significance ofexemplary embodiments of the disclosure will be described below withreference to the accompanying drawings, in which like numerals denotelike elements, and wherein:

FIG. 1 is a block diagram showing a schematic configuration of a vehiclecontrol system according to an embodiment;

FIG. 2 is a functional block diagram of the vehicle control system shownin FIG. 1 ;

FIG. 3 is a diagram for explaining a consistency determination method ofversions of software in an embodiment; and

FIG. 4 is a flowchart exemplarily showing control processing performedby a representative in-vehicle device shown in FIG. 1 .

DETAILED DESCRIPTION OF EMBODIMENTS

Even when versions of software of one or some of in-vehicle devicescomposing a vehicle control system are not consistent with a permittedversion, the present disclosure enables to provide control functionsthat can be executed by one or some of in-vehicle devices holdingsoftware that is consistent with the permitted version. Even when notall the control functions of the vehicle control system can be provided,one or some of control functions are allowed to be provided, andthereby, convenience of a user is improved.

Embodiment

Configuration

FIG. 1 is a block diagram showing a schematic configuration of a vehiclecontrol system according to an embodiment.

A vehicle control system 100 is a system which is composed of in-vehicledevices A to D which can communicate with one another and which realizespredetermined vehicle control by combining control functions of thein-vehicle devices A to D. While in the example of FIG. 1 , the vehiclecontrol system 100 is composed of the four in-vehicle devices A to D,the number of in-vehicle devices composing the vehicle control system100 is not limited to four. Examples of the predetermined vehiclecontrol realized by the vehicle control system 100 include automateddriving. The in-vehicle devices A to D correspond to ECUs which controlvehicle travelling such as acceleration, deceleration and steering, anda ECU which combines those ECUs controlling the vehicle travelling toperform travelling assistance. Notably, in the following description, aspecific in-vehicle device A which is one of the plurality of in-vehicledevices A to D composing the vehicle control system is referred to as“representative in-vehicle device A”.

FIG. 2 is a functional block diagram of the vehicle control system shownin FIG. 1 . FIG. 3 is a diagram for explaining a consistencydetermination method of versions of software according to an embodiment.

Representative in-Vehicle Device A

The representative in-vehicle device A is one of the in-vehicle devicesproviding the control functions of the vehicle control system 100, andfunctions as a master device in a consistency examination process forversions of software of the in-vehicle devices A to D. Therepresentative in-vehicle device A examines consistency in the versionsof software of all the in-vehicle devices A to D composing the vehiclecontrol system 100 with turn-on of a power supply of a vehicle being asa trigger. The representative in-vehicle device A includes a softwarestorage 10, a first consistency information storage 11, a secondconsistency information storage 12, a version acquisition unit 13, afirst determination unit 21, a second determination unit 22, aperformance control unit 23 and a transmission-reception unit 24.

The software storage 10 stores software for operating the representativein-vehicle device A. The representative in-vehicle device A executes thesoftware stored in the software storage 10, and thereby, realizes apredetermined function for controlling operation of the vehicle.

The first consistency information storage 11 stores a first consistencytable in which a combination of versions of software of all thein-vehicle devices A to D composing the vehicle control system 100 isdefined. The combination of versions of software of the in-vehicledevices A to D which combination is defined in the consistency table isa combination with which the vehicle control system 100 is confirmed tonormally operate and which includes versions permitted to besimultaneously performed. As shown in FIG. 3 , for example, the firstconsistency table can include a system number for specifying the vehiclecontrol system 100, and versions of software of the in-vehicle devices Ato D. For the system number, an identifier for specifying the vehiclecontrol system 100 may be used, or a version of the vehicle controlsystem 100 may be used. Moreover, in the example of the firstconsistency table in FIG. 3 , a single version is defined as the versionof each in-vehicle device. Instead, a range of versions of eachin-vehicle device which versions can be combined may be defined.Moreover, in the first consistency table, a plurality of sets ofcombinations of versions (or ranges of versions) may be defined whichcombination of versions (or ranges of versions) is permitted to besimultaneously performed. When one in-vehicle device holds a pluralityof pieces of software, a permitted version for each of the plurality ofpieces of software is defined in the first consistency table. The firstconsistency table is used as first consistency information with whichthe first determination unit 21 mentioned later determines whether ornot consistency exists in versions of software of the in-vehicle devicesA to D.

The second consistency information storage 12 stores a secondconsistency table for examining consistency of a version of software ofan in-vehicle device for each control function of the vehicle controlsystem 100. As shown in FIG. 3 , in the second consistency table, acontrol function composing the vehicle control system 100 is associatedwith one or more in-vehicle devices used for performing the controlfunction and a combination of versions of software of the one or morein-vehicle devices. When one in-vehicle device holds a plurality ofpieces of software, a permitted version of each of the plurality ofpieces of software is also defined in the second consistency table. Inthe example presented in the second consistency table shown in FIG. 3 ,there are a control function_1, a control function_2 and a controlfunction_3 as control functions which can be partially provided out ofthe plurality of control functions composing the vehicle control byvehicle control system 100. The second consistency table is provided foreach of those control functions. For example, there is defined in thetable for the control function_1 that the control function_1 isperformed by a combination of the in-vehicle devices A and B, and thatversions of software of the in-vehicle devices A and B needed forperforming the control function_1 are respectively defined as “12345”and “23456”. When the vehicle control provided by all the controlfunctions of the vehicle control system 100 is automated driving,examples of the control function_1, control function_2 and controlfunction_3 include a following travelling control function, a lanekeeping support function, a lane deviation alarm function and a brakesupport function. The second consistency tables are used as secondconsistency information with which the second determination unit 22mentioned later determines whether or not there is a control functionthat can be provided using one or some of the in-vehicle devices A to D.

The version acquisition unit 13 acquires the version of software of eachof the other in-vehicle devices B to D through communication. When thereis an in-vehicle device holding a plurality of pieces of software amongthe in-vehicle devices B to D, the version acquisition unit 13 acquiresall the versions of software held in the in-vehicle device.

The first determination unit 21 determines whether or not consistencyexists in the versions of software of all the in-vehicle devices A to Dcomposing the vehicle control system 100. The determination is performedby the first determination unit 21 collating the version of softwarestored in the software storage 10 of the representative in-vehicledevice A and the versions of software acquired from the other in-vehicledevices B to D by the version acquisition unit 13 individually with thefirst consistency table stored in the first consistency informationstorage 11.

Specific examples are described. When the versions for the in-vehicledevices acquired by the version acquisition unit 13 are as in versionacquisition example 1 shown in FIG. 3 , the first determination unit 21collates the acquired versions with the first consistency table shown inFIG. 3 , and as a result, determines that consistency exists in theversions of software of all the in-vehicle devices A to D. On thecontrary, when the versions for the in-vehicle devices acquired by theversion acquisition unit 13 are as in version acquisition example 2shown in FIG. 3 , the first determination unit 21 collates the acquiredversions with the first consistency table shown in FIG. 3 , and as aresult, determines that consistency does not exist in the versions ofsoftware of all the in-vehicle devices A to D since the version for thein-vehicle device B is not consistent with the first consistency table.

The second determination unit 22 determines whether or not there is,among the second consistency tables stored in the second consistencyinformation storage 12, one that is consistent with a combination ofversions of software of one or some of the in-vehicle devices composingthe vehicle control system 100. The determination is performed by thesecond determination unit 22 collating the version of software stored inthe software storage 10 of the representative in-vehicle device A andthe versions of software acquired from the other in-vehicle devices B toD by the version acquisition unit 13 with each of the second consistencytables stored in the second consistency information storage 12. Notably,the determination by the second determination unit 22 is processingperformed when the first determination unit 21 determines thatconsistency does not exist in the versions of software of all thein-vehicle devices A to D composing the vehicle control system 100.

Specific examples are described. When the versions for the in-vehicledevices acquired by the version acquisition unit 13 are as in versionacquisition example 2 shown in FIG. 3 , as mentioned above, the firstdetermination unit 21 determines that consistency does not exist in theversions of software of all the in-vehicle devices A to D composing thevehicle control system 100. In this case, the second determination unit22 collates the versions of software of the in-vehicle devices with thecombination of the versions of software defined in each of the secondconsistency tables shown in FIG. 3 . In version acquisition example 2shown in FIG. 3 , although the versions of software of the in-vehicledevices A, C and D are consistent with the permitted versions, theversion of software of the in-vehicle device B is not consistent withthe permitted version. The second determination unit 22 determines thatthere are the tables for the control function_2 and the controlfunction_3 as second consistency tables that are consistent with theversions of software of one or some of the in-vehicle devices composingthe vehicle control system.

The performance control unit 23 controls performance of the controlfunctions of the vehicle control system 100 based on the determinationresults of the first determination unit 21 and the second determinationunit 22. When the first determination unit 21 determines thatconsistency exists in the versions of software of all the in-vehicledevices A to D composing the vehicle control system 100, the performancecontrol unit 23 permits performance of the vehicle control of thevehicle control system 100 which vehicle control can be performed usingall the in-vehicle devices A to D. When the second determination unit 22determines that there exists a second consistency table consistent withversions of software of one or some of the in-vehicle devices composingthe vehicle control system the performance control unit 23 permitsperformance of only the control function associated with the secondconsistency table that is determined to exist. When the seconddetermination unit 22 determines that there does not exists a secondconsistency table consistent with versions of software of one or some ofthe in-vehicle devices composing the vehicle control system, theperformance control unit 23 prohibits performance of all the controlfunctions of the vehicle control system 100.

The transmission-reception unit 24 transmits and receives various kindsof information and instructions to/from the in-vehicle devices B to D.

In-Vehicle Devices B to D

Each of the in-vehicle devices B to D includes a software storage 30 anda transmission-reception unit 31. The software storage 30 storessoftware for operating each of the in-vehicle devices B to D. Each ofthe in-vehicle devices B to D executes the software stored in thesoftware storage 30, and thereby, realizes a predetermined function forcontrolling operation of the vehicle. The transmission-reception unit 31transmits and receives various kinds of information and instructionsto/from the other in-vehicle devices.

Control Processing

Hereafter, with reference to FIG. 2 and FIG. 4 , control processingperformed by the representative in-vehicle device A is described.

FIG. 4 is a flowchart exemplarily showing control processing performedby the representative in-vehicle device shown in FIG. 1 .

Step S1: the version acquisition unit 13 acquires the versions ofsoftware of the other in-vehicle devices B to D. After that, the processmoves to step S2.

Step S2: the first determination unit 21 collates the version ofsoftware of the representative in-vehicle device A and the versions ofsoftware acquired from the other in-vehicle devices B to D with thefirst consistency table stored in the first consistency informationstorage 11, and determines whether or not consistency exists in theversions of software of the in-vehicle devices A to D. When thedetermination in step S2 is YES, the process moves to step S3, and inthe other case, the process moves to step S4.

Step S3: the performance control unit 23 permits performance of thevehicle control using the in-vehicle devices A to D combined. Afterthat, the process is ended.

Step S4: the second determination unit 22 collates the version ofsoftware of the representative in-vehicle device A and the versions ofsoftware acquired from the other in-vehicle devices B to D with thesecond consistency tables stored in the second consistency informationstorage 12, and determines whether or not a second consistency tableconsistent with a combination of versions of software of one or some ofthe in-vehicle devices A to D exists. Notably, since with thedetermination in step S2, an in-vehicle device having software in aversion not consistent with the first consistency table can bespecified, the determination processing in step S4 may be performed onlyusing the versions of software of the in-vehicle devices which versionsare determined to be consistent with the first consistency table in stepS2. When the determination in step S4 is YES, the process moves to stepS5, and in the other case, the process moves to step S6.

Step S5: the performance control unit 23 permits performance of controlfunctions associated with the second consistency table determined toexist by the second determination unit in step S4, and prohibitsperformance of the other control functions of the vehicle control system100. After that, the process is ended.

Step S6: the performance control unit 23 prohibits performance of allthe control functions of the vehicle control system 100. After that, theprocess is ended.

The aforementioned control processing in FIG. 4 may be realized by adedicated circuit, or may be realized, for example, by causing acomputer such as an ECU having a processor, a ROM, a RAM, a hard diskdrive and the like to perform processes in the individual steps. When acomputer such as an ECU is caused to perform such control processes inFIG. 4 , a program described such that these control processes can beperformed may be prestored in a storage apparatus such a ROM and a harddisk drive, and a processor included in the computer may be caused toread the program from the storage apparatus and to execute it.

Effects and Others

As described above, with the vehicle control system 100 according to thepresent embodiment, even in the case where versions of software of oneor some of the in-vehicle devices A to D composing the vehicle controlsystem 100 are not consistent with permitted versions, when controlfunctions that can be performed by one or some of in-vehicle devicesthat hold software in permitted versions exist, performance of thecontrol function is permitted. Accordingly, even when one or some ofin-vehicle devices are restricted to be used as in cases where repair ofan in-vehicle device or update of software of an in-vehicle device isneeded, one or some of functions of the vehicle control system 100 canbe provided. Hence, convenience of a user can be improved.

Notably, the determination processing of the first determination unit 21and the second determination unit 22 may be performed every time a powersupply of a vehicle is turned on. By examining that consistency existsin the versions of software of the in-vehicle devices A to D every timethe power supply of the vehicle is turned on, there can be reduced apossibility that unexpected vehicle control is performed due toinconsistency in the versions of software of the in-vehicle devices A toD.

The present disclosure can be used for a vehicle control system whichrealizes a predetermined vehicle control function with a combination ofa plurality of in-vehicle devices.

What is claimed is:
 1. A master device configured to control a pluralityof devices mounted on a vehicle, the master device comprising: a storageconfigured to store consistency information on a permitted combinationof versions of software respectively installed on the plurality ofdevices; and a processor configured to: acquire the versions of softwarerespectively installed on the plurality of devices; perform a firstdetermination and a second determination by collating the versions ofthe software acquired from the plurality of devices with the storedconsistency information, the first determination determining whether theversions of the software respectively installed on the plurality ofdevices are compatible with each other, and the second determinationdetermining whether a predetermined subset of the versions of thesoftware respectively installed on the plurality of devices arecompatible with each other; and control execution of predeterminedcontrol functions using the plurality of devices based on a result ofthe first determination that the versions of the software respectivelyinstalled on the plurality of devices are compatible with each other,and control execution of a subset of the predetermined control functionsbased on both a result of the first determination that the versions ofthe software respectively installed on the plurality of devices are notcompatible with each other and a result of the second determination thatthe predetermined subset of the versions of the software respectivelyinstalled on the plurality of devices are compatible.
 2. The masterdevice according to claim 1, wherein the processor is configured toperform determination processing every time when a power supply of thevehicle is turned on.
 3. The master device according to claim 1, whereinthe stored consistency information is information on the permittedcombination of the versions of the software that is permitted to beperformed simultaneously.
 4. A vehicle control method of a master deviceconfigured to control a plurality of devices mounted on a vehicle, themethod comprising: storing, by a computer of the master device,consistency information on a permitted combination of versions ofsoftware respectively installed on the plurality of devices; acquiring,by the computer, the versions of the software respectively installed onthe plurality of devices; performing, by the computer, a firstdetermination and a second determination by collating the versions ofthe software acquired from the plurality of devices with the storedconsistency information, the first determination determining whether theversions of the software respectively installed on the plurality ofdevices are compatible with each other, and the second determinationdetermining whether a predetermined subset of the versions of thesoftware respectively installed on the plurality of devices arecompatible with each other; and controlling, by the computer, executionof predetermined control functions using the plurality of devices basedon a result of the first determination that the versions of the softwarerespectively installed on the plurality of devices are compatible witheach other, and controlling, by the computer, execution of a subset ofthe predetermined control functions based on both a result of the firstdetermination that the versions of the software respectively installedon the plurality of devices are not compatible with each other and aresult of the second determination that the predetermined subset of theversions of the software respectively installed on the plurality ofdevices are compatible.